[Snort-sigs] Sourcefire VRT Certified Rules Update
research at ...435...
Wed Apr 4 12:47:00 EDT 2007
-----BEGIN PGP SIGNED MESSAGE-----
Sourcefire VRT Certified Rules Update
The Sourcefire VRT is aware of vulnerabilities affecting Real Networks
Helix Server, IBM Lotus SameTime ActiveX control and an issue with ipv6
traffic handling on OpenBSD systems. This release also contains an
upgraded detection engine.
With the release of Snort 18.104.22.168 Sourcefire has added additional
detection for the OpenBSD IPv6 Fragmentation Overflow. Additionally
Snort 22.214.171.124 has addressed a number of potential security-related
issues as reported by customers, internal investigations,
and third-party code audits.
OpenBSD IPv6 Fragmentation Overflow (CVE-2007-1365) and OpenBSD ICMP6
Denial of Service (CVE-2007-0343):
The Snort 126.96.36.199 release includes detection capabilities for attacks
that attempt to exploit the IPv6 fragmentation overflow in OpenBSD-based
Important Information about IPv6 Fragmentation Overflow Detection
Detection of traffic that attempts to exploit the IPv6 fragmentation
overflow issue is enabled by default. If your Snort Sensors are deployed
inline on your network, the malicious traffic is dropped automatically.
In order to disable this functionality, the following line must be added
config ipv6_frag: drop_bad_ipv6_frag off
Events generated by the preprocessor are identified as GID 123 and SIDs
9 and 10.
Real Networks Helix Server (CVE-2006-6026):
The Real Networks Helix Server fails to properly check user-supplied
data to the application. This may allow a remote attacker to overflow a
fixed length buffer and execute code on a vulnerable host.
A rule to detect attacks targeting this vulnerability is included in
this release and is identified as SID 10407.
IBM Lotus SameTime (CVE-2007-1784):
IBM Lotus SameTime fails to properly process user-supplied input. This
may allow an attacker to load DLL files and execute code by supplying
suitable arguments to the loadLibrary function.
Rules to detect attacks targeting this vulnerability are included in
this release and are identified as SIDs 10412 through 10417.
For a complete list of new and modified rules please see:
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
More information about the Snort-sigs